\subsubsection{Variables}
\label{sec:20Variables}
Here we describe the variables used.

\begin{center}
	\begin{tabular}{lp{14cm}}
    $A, B$        & participants Alice and Bob.\\
    \\
    $pk_A$        & the public key belonging to Alice.\\
    $sk_A$        & the secret key belonging to Alice.\\
                  & Note: there are several (secret key, public key) pairs in this protocol)\\
    \\
    $E_A$         & the Ethereum address of Alice.\\
    $\Xi_{A,i}$   & an `anonymous' Ethereum address belonging to Alice, where $i\in\mathbb{N}$ is an index, for distinguishing between multiple anonymous addresses.\\
    \\
    $c, d, e, f \in \mathbb{R}^+\rvert_{dp}$ & used to denote ERC-20 token values.\\
                  & Note that in practice, the accuracy of these values is restricted by the number of decimal places ($dp$) prescribed in the ERC-20 token contract.\\
    \\
    $\sigma$      & a `salt' used to provide uniqueness to commitment preimages.\\
    $\sigma_{\vec{AB}}$ & stresses that a salt is being shared privately from Alice to Bob.\\
    \\
    $Z$           & An ERC-20 commitment; a zero-knowledge commitment representing ownership of an amount of ERC-20 tokens. \\
    $Z_A$         & Stresses that an ERC-20 commitment belongs to Alice.\\
    $Z_c$         & Stresses that an ERC-20 commitment represents a value of $c$ (as denominated in the native currency of the ERC-20 token).\\
    $Z_{l}$       & Stresses that an ERC-20 commitment is the $l^{th}$ leaf of a Merkle Tree (see below for $M$).\\
                  & Note that the meaning of these (seemingly colliding or ambiguous) subscripts will be clear from context.\\
    $N$           & A nullifier for an ERC-20 commitment $Z$.\\
    $N_A$         & A nullifier for the ERC-20 commitment $Z_A$\\
    $N_c$         & A nullifier for the ERC-20 commitment $Z_c$.\\
                  & Note that the meaning of these (seemingly colliding or ambiguous) subscripts will be clear from context.\\
    \\
		$M$           & A binary Merkle Tree.\\
    $M_l$         & A binary Merkle Tree with $l$ non-zero leaves (where leaves are populated in order `from left to right').\\
    $\roott_l$      & The root of $M_l$ (`$M$' is omitted because context will be clear).\\
    \\
    $\phi_{L}$    & $[\phi_{L}(d-1), \phi_{L}(d-2),..., \phi_{L}(1), \phi_{L}(0)]$ - The path from a leaf $L$ to the root of a Merkle Tree $M$, where $\phi_L(0) = \roott$.\\
    $\phi$        & $[\phi_{d-1}, \phi_{d-2},..., \phi_{1}, \phi_0]$ - Alternative notation for the path from a leaf, where the leaf $L$ is clear from the context. $\phi_0 = \roott$.\\
    $\psi_{L}$    & $[\psi_{L}(d-1), \psi_{L}(d-2),..., \psi_{L}(1), \psi_{L}(0)]$ - The sister-path from a leaf $L$ to the root of a Merkle Tree $M$, where $\psi_L(0) = \phi_L(0) = \roott$.\\
    $\psi$        &  $[\psi_{d-1}, \psi_{d-2},..., \psi_{1}, \psi_0]$ - Alternative notation for the sister-path from a leaf, where the leaf $L$ is clear from the context. $\psi_0 = \roott$.\\
    \\
		$x$           & Public inputs to a zk-SNARK. \\
		$\omega$      & Private inputs to a zk-SNARK.\\
		$C$           & An arithmetic circuit $C: (\omega, x) \to \{0,1\}$\\
		$p_C$         & A proving key for the circuit $C$. \\
		$vk_C$        & A verification key for the circuit $C$. \\
    $\pi(p_C, x, \omega)$ & A proof for the circuit $C$, public inputs $x$, and private inputs $\omega$ \\
    $\pi_{C, x, \omega}$ & An abbreviation of the above. \\
    $\pi$         & An abbreviation of the above, when the context of the proof is clear.\\
    \\
    $h()$         & A one-way hashing function. Nightfall currently uses sha256 hashing throughout.\\
  \end{tabular}
\end{center}